ISO 27701 LI key terms

A documented management system that establishes privacy policies, objectives, and processes for handling personally identifiable information, built by extending an ISO/IEC 27001 information security management system with ISO/IEC 27701 privacy requirements and guidance.

Any information that relates to an identified or identifiable natural person, or that can be linked to one, whether held electronically or on paper, and whether about customers, employees, or other data subjects.

The natural person to whom PII relates, also called the data subject. The PIMS exists to protect this individual's privacy rights, and their consent, requests, and complaints drive many operational controls.

The organization, alone or jointly with others, that determines the purposes and means of processing PII. ISO/IEC 27701 assigns controllers an extended control set covering lawful basis, transparency, and rights fulfilment.

An organization that processes PII on behalf of and under the instructions of a PII controller. ISO/IEC 27701 gives processors a separate control set addressing client agreements, sub-processors, and return or deletion of data.

Two or more organizations that jointly determine the purposes and means of processing PII. They must define and make transparent their respective privacy responsibilities, often through a written arrangement.

A category of PII warranting stronger protection because misuse could cause serious harm, such as health, biometric, financial, or location data. Identification of sensitive categories drives risk assessment and control selection.

Any operation performed on PII, such as collection, recording, storage, alteration, retrieval, disclosure, or destruction. The PIMS scope statement and risk assessments are built around the processing activities actually performed.

A freely given, specific, informed, and unambiguous indication of the PII principal's wishes by which they agree to processing. Where consent is the lawful basis, the PIMS must show it can be captured, evidenced, and withdrawn.

The legal ground relied upon for a processing activity, such as consent, contract, legal obligation, or legitimate interest. Controllers must determine and document a lawful basis for each processing purpose.

An approach that embeds privacy protection into systems, processes, and products from the outset rather than adding it afterwards, including data minimisation, default protective settings, and early consideration of privacy risks.

The principle that the most privacy-protective settings are applied automatically, so that only PII necessary for each specific purpose is processed without the principal having to change any configuration.

Collecting and processing only the PII that is adequate, relevant, and necessary for the stated purpose, and retaining it no longer than required. It reduces exposure and simplifies compliance obligations.

The rule that PII is collected for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those purposes. Each new use may require a fresh assessment or lawful basis.

The entitlements of PII principals, typically including access, correction, erasure, restriction, portability, and objection. The PIMS must provide workable procedures and channels for receiving and answering such requests.

Replacing identifying attributes with artificial identifiers so that PII can no longer be attributed to a principal without additional separately held information. It reduces risk while preserving some analytical usefulness of data.

Irreversibly transforming PII so that the individual can no longer be identified by any means reasonably likely to be used. Properly anonymised data falls outside PIMS PII scope, so the technique must be robust.

A third party engaged by a PII processor to carry out part of the processing. The processor must obtain controller authorisation, impose equivalent privacy obligations by contract, and maintain a list of such parties.

A contract between controller and processor that specifies the subject matter, duration, nature, and purpose of processing, plus obligations on confidentiality, security, sub-processing, assistance, and deletion or return of PII.

A structured inventory describing each processing activity, its purposes, categories of PII and principals, recipients, transfers, retention periods, and security measures. It is a core input to scoping, risk assessment, and audit sampling.

A documented definition of the organizational units, locations, systems, products, and processing activities covered by the PIMS, including justified exclusions and interfaces with third parties. It bounds every later audit and risk activity.

The internal and external issues, legal and regulatory obligations, contractual requirements, and stakeholder expectations relevant to privacy that the organization must understand before designing the PIMS.

Individuals and organizations with an interest in the PIMS, such as customers, employees, regulators, and partners. Their privacy requirements and expectations must be identified and addressed in the system.

A structured comparison of current privacy practices against ISO/IEC 27701 requirements and Annex controls, producing a prioritized list of missing or weak controls that feeds the implementation plan.

A process that identifies threats and vulnerabilities affecting PII, estimates likelihood and impact on individuals and the organization, and determines which risks require treatment before or during implementation.

A maintained log of identified privacy risks, each with owner, rating, treatment decision, and status. It evidences that risk-based thinking is operating and is a frequent focus of certification auditors.

A plan specifying how each unacceptable privacy risk will be addressed, through mitigation, transfer, avoidance, or acceptance, including resources, responsibilities, and target dates.

A document listing all ISO/IEC 27701 Annex controls, stating for each whether it is applicable, how it is implemented, and why any exclusion is justified. It is mandatory for certification and audited closely.

The privacy-specific control sets in ISO/IEC 27701, split into those for PII controllers and those for PII processors, each mapped to ISO/IEC 27002 security controls and selected through the SoA.

A resourced schedule describing the tasks, owners, dependencies, milestones, and timelines needed to build or extend the PIMS to the required control set, tracked to completion.

Visible leadership support for the PIMS, expressed through approved policy, assigned roles, allocated resources, management reviews, and decisions on risk. Certification audits test whether such commitment is real.

A top-level documented statement of the organization's privacy intentions, commitments, and objectives, approved by management and communicated internally and, where relevant, to external interested parties.

Measurable goals the PIMS aims to achieve, such as reducing overdue rights requests or completing supplier assessments on schedule. They must be consistent with the privacy policy and monitored.

Information the PIMS requires to be created, maintained, and controlled, including policies, procedures, records, and evidence, with rules for approval, version control, availability, and retention.

An operational procedure describing how staff collect, use, store, share, transfer, and dispose of PII in line with policy, including handling of data subject requests and privacy incidents.

Any event that compromises the confidentiality, integrity, or availability of PII, or that breaches privacy obligations. It must be detected, recorded, assessed, contained, notified where required, and reviewed for lessons.

The process of informing regulators, PII principals, or customers about a privacy incident within required timeframes and content, as set by law, contract, and the organization's own procedures.

A technique that traces how PII moves between systems, departments, and third parties, showing collection points, storage locations, transfers, and disposal, and revealing where controls or agreements are missing.

Due diligence that evaluates whether a vendor handling PII meets required privacy controls, including security, sub-processing, breach notification, and audit rights, before and during the relationship.

The systematic collection of data on PIMS performance, such as incident counts, request turnaround, training completion, and control test results, to show the system works and to inform decisions.

Quantitative indicators chosen to track privacy performance and risk, defined with method, frequency, owner, and threshold, so results are comparable over time and can trigger action.

An independent, planned examination of the PIMS against its own requirements and ISO/IEC 27701, performed by impartial auditors who report findings so that nonconformities can be corrected before certification.

A periodic, top-management examination of PIMS status and performance, using defined inputs such as audit results, risks, and metrics, and producing decisions on improvement, resources, and changes.

A failure to meet a requirement of ISO/IEC 27701, the organization's own PIMS criteria, or applicable obligations. It must be recorded, contained, and corrected, with root cause analysis where significant.

Action taken to eliminate the cause of a detected nonconformity or incident so it does not recur, including root cause analysis, implementation, and verification of effectiveness.

The ongoing process of enhancing PIMS suitability, adequacy, and effectiveness by using audit results, metrics, incidents, and reviews to identify and implement changes, rather than waiting for failures.

A staged framework used to assess how embedded and effective privacy practices are, from ad hoc to optimized, helping an organization plan improvement steps beyond bare conformity.

An independent assessment by an accredited certification body that evaluates the PIMS against ISO/IEC 27701 and the underlying ISO/IEC 27001 requirements, leading to issue, maintenance, or refusal of a certificate.

An accredited organization that performs PIMS certification audits and issues certificates, operating under accreditation rules and required to be impartial and competent in privacy and information security.

Formal recognition by a national accreditation authority that a certification body is competent to audit and certify against specific standards, giving the resulting certificate credibility and international recognition.

The first certification audit phase, reviewing documented information, scope, SoA, risk treatment, and readiness to confirm the PIMS is prepared for the detailed Stage 2 assessment.

The main certification audit phase, gathering evidence on site or remotely to verify that the PIMS is implemented, effective, and conforms to ISO/IEC 27701 requirements and the organization's own criteria.

A periodic post-certification audit, typically annual, that checks the PIMS continues to conform and improve, covering selected controls, changes, and follow-up of prior findings.

A full audit conducted before a certificate expires, typically every three years, to confirm the PIMS as a whole remains effective and conforms, allowing the certificate to be renewed.

Verifiable records, statements, or observations demonstrating that a requirement is met, such as signed agreements, logs, training records, and completed assessments. Auditors base findings on such evidence.